feat: adds composite actions support to known-vulnerable-actions

docs/audits.md

@@ -333,9 +333,9 @@ within an authentic commit (or an authentic tag/branch reference).
 
 ## `known-vulnerable-actions`
 
-| Type     | Examples                       | Introduced in | Works offline  | Enabled by default |
-|----------|--------------------------------|---------------|----------------|--------------------|
-| Workflow  | [known-vulnerable-actions.yml] | v0.1.0        | ❌             | ✅                 |
+| Type             | Examples                       | Introduced in | Works offline  | Enabled by default |
+|------------------|--------------------------------|---------------|----------------|--------------------|
+| Workflow, Action | [known-vulnerable-actions.yml] | v0.1.0        | ❌             | ✅                 |
 
 [known-vulnerable-actions.yml]: https://github.com/woodruffw/gha-hazmat/blob/main/.github/workflows/known-vulnerable-actions.yml
 

src/audit/known_vulnerable_actions.rs

@@ -7,15 +7,16 @@
 
 use anyhow::{anyhow, Context, Result};
 
+use super::{audit_meta, Audit};
+use crate::finding::Finding;
+use crate::models::CompositeStep;
 use crate::{
     finding::{Confidence, Severity},
     github_api,
     models::{RepositoryUses, Uses},
     state::AuditState,
 };
 
-use super::{audit_meta, Audit};
-
 pub(crate) struct KnownVulnerableActions {
     client: github_api::Client,
 }
@@ -161,4 +162,30 @@ impl Audit for KnownVulnerableActions {
 
         Ok(findings)
     }
+
+    fn audit_composite_step<'a>(&self, step: &CompositeStep<'a>) -> Result<Vec<Finding<'a>>> {
+        let mut findings = vec![];
+
+        let Some(Uses::Repository(uses)) = step.uses() else {
+            return Ok(findings);
+        };
+
+        for (severity, id) in self.action_known_vulnerabilities(&uses)? {
+            findings.push(
+                Self::finding()
+                    .confidence(Confidence::High)
+                    .severity(severity)
+                    .add_location(
+                        step.location()
+                            .primary()
+                            .with_keys(&["uses".into()])
+                            .annotated(&id)
+                            .with_url(format!("https://github.com/advisories/{id}")),
+                    )
+                    .build(step.action())?,
+            );
+        }
+
+        Ok(findings)
+    }
 }